CVE-2023-3677

CVE-2023-3677 affects the WooCommerce PDF Invoice Builder plugin for WordPress (versions

CVE-2023-0689 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mffirstname' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrar...

CVE-2023-4245

The CVE-2023-4245 issue affects the WooCommerce PDF Invoice Builder for WordPress (versions up to 1.2.89). Root cause: missing capability check in GetInvoiceDetail, enabling unauthorized access to invoices by subscribers who can guess order and invoice IDs. Impact stated in sources is unauthorize...

PT-2023-5229 · Schweitzer Engineering Laboratories · Acselerator Bay Screen Builder

Name of the Vulnerable Software and Affected Versions: Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder Software versions prior to 1.0.49152.778 Description: The issue is related to an improper limitation of a pathname to a restricted directory, allowing relative path...

PT-2023-27993 · WordPress · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoice Builder plugin for WordPress versions up to, and including, 1.2.90 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This...

WordPress plugin WooCommerce PDF Invoice Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF...

WordPress plugin WooCommerce PDF Invoice Builder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL server set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF Invoi...

WordPress plugin WooCommerce PDF Invoice Builder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF...

PT-2023-28350 · WordPress · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoice Builder for WordPress versions up to, and including, 1.2.89 Description: The issue allows unauthorized access to data due to a missing capability check on the GetInvoiceDetail function. This makes it possible for...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.3.1 is vulnerable to Sensitive Data Exposure

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.3.2 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-0689 Patch priority Low CVSS severity Low 4.3 Developer Wpmet PSID 4be7cb75c51f Credits Ramuel Gall...

PT-2023-26055 · WordPress · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoice Builder plugin for WordPress versions up to, and including, 1.2.90 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the Save function. This allows...

Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder 路径遍历漏洞

Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder is a software tool for power system monitoring and control from Schweitzer Engineering Laboratories, USA. A security vulnerability exists in Schweitzer Engineering Laboratories SEL-5036 acSELerator Bay Screen Builder that...

WordPress plugin WooCommerce PDF Invoice Builder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. WordPress plugin WooCommerce PDF...

PT-2023-25693 · WordPress · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoice Builder plugin for WordPress versions up to, and including, 1.2.89 Description: The issue arises from insufficient escaping on the user-supplied pageId parameter and lack of sufficient preparation on the existing SQL...

PT-2023-18350 · WordPress · Colibri Page Builder

Name of the Vulnerable Software and Affected Versions: Colibri Page Builder for WordPress versions up to, and including, 1.0.227 Description: The issue allows authenticated attackers with administrator-level privileges to perform SQL Injection via the post id parameter due to insufficient escapin...

WordPress Plugin Colibri Page Builder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Colibri Page Build...

PT-2023-27997 · WordPress · Woocommerce Pdf Invoice Builder

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoice Builder for WordPress versions up to, and including, 1.2.90 Description: The issue is related to a missing nonce check on the SaveCustomField function, making it possible for unauthenticated attackers to create invoice...

WordPress plugin WooCommerce PDF Invoice Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plugin. A security vulnerability exists in...

Popup Builder < 4.2.0 - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. Note: The vendor was made aware of th...

Popup Builder < 4.2.0 - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. Note: The vendor was made aware of th...